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SSF/LTV ProoeHant Operation Hazard Analysis 


Space Station Freedom (SSF), as a transportation node tor Space Exploration Initiative missions, would involve the 
assembly and refurbishing of lunar and Mars transfer vehicles. This includes operations involving cryogenic propellants 
(LH2 & L02) such as storing and handling of loaded propellant tanks, assembly onto the vehicle, and propellant 
transfer. Cryogenic propellants dictate rigorous safety precautions and impose unique requirements to ensure safety to 
both personnel and SSF elements. The objective of this study is to identify potential hazards and risks associated with 
cryogenic propellants. This involves identification of pertinent system design features and operational procedures. 
Criticality of identified risks/hazards shall be assessed and those that fall in the catastrophic and critical categories shall 
include mitigating solutions. 
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SSF/LTV Propellant Operation Hazard Analysis 


• Hazard Analysis Conducted To Define Hazards And 
Risks Of Storing, Handling And Transferring Cryogenic 
Propellants At SSF To Support LTV 


• Objective: 

- Identify Hazard And Risk - Hardware, Operations, 
Human Error 

- Assess Criticality 

- Propose Mitigating Solutions 



SSF/LTV Propellant Operation Hazard Analysis (Cont.) 


Approach 

The initial approach to the hazard analysis consisted of selecting a baseline Lunar Transfer Vehicle (LTV) design from 
previous LTV studies. This reference vehicle provided a point of departure concept and was used to generate a detailed 
operational scenario. Included in the operational scenario are activities such as propellant refueling, storage, mission 
refurbishment, safing and propellant topoff of the drop tanksets. Hazards identified from these activities are then 
analyzed to provide mitigating measures in order to either eliminate them or reduce the risks to an acceptable level. 
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SSF/LTV Prope; L 


Approach: 

• Hazard Assessment Based On Selected Reference 
Scenario From LTV Design Studies 


Assume Propellent Mim^Depot For Propellant 
And Contingency Supply 

Develop/ Assess Timelines And Scenarios For 
Propellant Refueling And Storage 


Propose Measures To Mitigate Risks Of Identified 
Hazards - Assess Probability Of Occurrence For 
Hazards Without Suitable Solutions 
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Task Plan 


The SSF/LTV propellant operation hazard analysis is subdivided into four subtasks. The first subtask involves historical 
review of documentation pertinent to safety of cryogenic systems in space. The information derived from this effort 
provides an initial starting point and information base for the subsequent tasks. Subtask 2 examines risks and hazards 
associated with propellant refueling operations in reference to conditions producing the hazards and the severity of the 
impact on SSF. Subtask 3 is similar to subtask 2 except that it investigates vehicle operations other than refueling. 
These operations include vehicle turnaround operations, docking/storage, safing and various maintenance operations. 
Subtask 4 provides mitigating solutions to risk and hazards identified in both subtask 2 and 3. 

Subtask milestones are listed below. The completion of the propellant operation hazard analysis is scheduled by 
August 9, 1991 . The final report , written in "white paper" form, will be submitted by September 6, 1991 . 
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SSF/LTV Propellant Operation Hazard Analysis 

Task Plan 

• Subtask 1 - Historical Review 

• Subtask 2 - Cryogenic Transportation Refueling Risks 

• Subtask 3 - Vehicle Operation Risks 

• Subtask 4 - Mitigating Solutions 


Schedule Milestone: 

Subtask 1 - Ongoing 

Subtask 2 - Completed 9 July 1991 

Subtask 3 - Completed 2 August 1991 

Subtask 4 - Underway - Complete By 9 August 1991 

Final Report - 6 September 1991 
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LTV Configuration 

The LTV configuration baseline for the cryogenic propellant operation hazard study is shown below. This configuration 
provides a reference concept that is used as starting point for the analysis. Basic elements of the LTV are the crew & 
cargo modules, 6 drop tanksets and aerobrake assembly which are all attached to the common propulsion/avionics 
core. This vehicle can deliver 14.6 tonnes of cargo including a crew of 4 to the Lunar surface and return to the SSF 
using 174 tonnes of cryogenic propellant. Total vehicle dry mass is 27.5 tonnes. 

Propellant Tanksets 

The propulsion/avionics core module contains 5 tanks -- 4 LH2 tanks spaced symmetrically around an L02 tank. The 
tanks are all mounted to the lower cross beams of the core structure. The L02 tank is 4.4 m long and 2.9 m in diameter 
while the LH2 tanks are 4.2 m long and 2.6 m diameter. Total propellant capacity of the core tanksets is 32.5 tonnes 

The aerobrake assembly protects the crew during the aeroassisted return to the SSF. The system contains 2 return tank 
pallets consisting of 3 LH2 tanks and 2 L02 tanks. Total aerobrake propellant load is 7.2 tonnes. 

Each drop tankset consists of 1 LH2 and 1 L02 tank. The propellant capacity of an individual tankset is approximately 
28 tonnes. There are 3 tanksets (2 TLI and 1 LOI) per tank arrangement and there are two tankset arrangements per 
Lunar vehicle, placed on each side of the LTV. Each tankset has a support structure which connects it to the adjacent 
tankset as well as the tank vehicle. The Trans Lunar Injection (TLI) tanksets are jettisoned after the TLI burn. The 
remaining middle drop tanksets are released after Lunar Orbit Injection (LOI) burn. 
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Lunar Transfer Vehicle Mission 


A typical lunar mission consists of an out-bound leg, and an initial/steady state in-bound leg. The out-bound leg for an 
initial flight begins with the Trans Lunar Orbit (TLI) preparation and burn. In this phase, the outer droptanks are 
separated after completion of the TLI burn. This is then followed by a Lunar Orbit Injection (LOI) burn, separation of the 
landing & Low Lunar Orbit (LLO) elements, and descent to the Lunar surface. The in-bound leg begins with ascent from 
the surface to LLO, where the lander rendezvous and docks with the aerobrake element. Following docking, the system 
performs Trans Earth Injection (TEI), conducts mid-course correction, reentry and LEO node circularization prior to 
docking back to SSF. 

The only phase of the lunar mission investigated for the hazard analysis involves the LTV assembly performed at SSF. 
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Two IVlajor Class Of Hazards 
Identified; Tank Handling Am 
Propellant Venting/Dumping 


Aerobrake 
Rendezvous / 


ANALYSIS OFFICE 





545 


LEO Processing - Timelines 


For the initial flight mission, there are six primary activities performed at LEO (SSF). The hardware delivery phase (16.5 
days), is the period when LTV components are delivered and collected at SSF. As the subsystems arrive, element level 
checkouts are conducted to verify their integrity. In the assembly phase (17.5 days) the LTV components are assembled 
into an operational configuration. This is followed by the verification phase (16 days) that ensures the flight readiness of 
the system. After the system is in mission ready condition, the propellant servicing phase (9 days) assembles the drop 
tanks to the mission vehicle. The closeout phase (9 days days) provides final launch readiness status. The last activity is 
the launch phase. This consist of mission crew boarding, transfer of LTV to the injection burn area and initiating the 
Trans Lunar Injection (TLI). The total processing time for an initial flight mission is 61 days and it was assumed that 
there are two eight hour shifts per day. 

The mission processing steps for a steady state mission increased from six to seven. However the times required for 
many of the activities are reduced. The first processing phase of a steady state mission is the refurbishment phase (75.5 
days), where the returning LTV is completely checked out and refurbished. In the hardware delivery phase (13.5 days), 
the propellant drop tanksets are delivered at SSF and element level checkouts are conducted. In the assembly phase 
(10 days), the replaceable LTV components are assembled into an operational configuration. This is followed by the 
verification phase (12 days) that ensures the flight readiness condition of the system. The servicing, closeout, and 
launch phases are similar in both procedure and processing time to those performed for an initial flight mission. The 
total processing time for a steady state mission is 122.5 days 

The time elements of interest during LEO processing occur in the hardware delivery, assembly, and propellant servicing 
phases. During portions of these phases, activities involving cryogenic propellants are performed. These include 
docking, storage, propellant transfer and topoff. 



- Timelines 


LEWIS RESEARCH CENTER 



Hardware Del. 
16.5 Daysf| 


gsiaisg 

AiBBrA 1 wl 


Ass'y 
|l7.5 Days 


ipan 

wmm 


Refurbishment 


Verification 

1 6 Davs I Prop. Serv. 








LTV - Typical Interfaces 


The majority of the hazards identified in the study are failures that originate at the various vehicle/SSF interfaces. These 
interfaces include structural attachments, propellant line quick disconnect's (QD's), vent QD's, electrical/avionics QD's 
and grapple fittings used for RMS translation. Failure modes associated with these interlaces are a function of the 
components involved and are independent of vehicle configuration since these interfaces will be inherent in most 
vehicle designs. Changes in the LTV configuration would primarily result in differences in the number of interfaces 
required. 
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LTV Refueling Activities 

Subtask 2 examines cryogenic propellant refueling hazards. The refueling activities performed include drop tank 
changeout, drop tankset topoff, core tankset propellant loading and aerobrake tankset propellant loading. Droptank 
changeout consists of translation of the drop tanks using the RMS and attachment to the core LTV. Drop tankset topoff 
is performed using the mini-depot to replenish boiloff losses of 2%/month. Other refueling activities of concern involve 
the propellant loading of both the core and the aerobrake tanksets. Propellant for these tanksets is supplied from the 
drop tanks. Transfer line and tank chilldown are performed prior to the transfer process. 
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LTV Ref ueling Activities 
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• Drop Tank Change-Out 

• Drop Tankset T opoff With Mini-Depot 

• Core Tankset Propellant Loading 

• Aerobrake Tankset Propellant Loading 



LTV Refueling Functional Summary 

This chart lists the major functions performed during the refueling activities. These functions are an inherent part of 
orbital cryogenic propellant resupply regardless of the tank size, geometry, or vehicle configuration. 
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L Refueling Functional Summary 

• Leak Check/Mafe/Demate Of Quick Disconnect 

• Propellant Tank/Transfer Line Chilldown 

• Tank Propellant Load In Low Gravity Environment 

• Tank Venting/Dumping - Nominal And Emergency 

• T ransfer Line Purging/Safing 

• Tank Transport/Handling 


Functions Are Generic - Not Dependent On A 
Specific Vehicle Configuration 
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Representative Tirnefine/Hazard Tables 


This chart shows a representative illustration of the tables generated during the hazard analysis. Under subtask 2, a 
total of four timeline operations corresponding to the number of refueling activities were created. The refueling activities 
have been broken down into detailed steps along with their respective operation times. These times were derived from 
a ground operations data base and adjusted for LEO operations. The timelines are consistent with previously derived 

numbers*. 

Seven hazard tables were created using the refueling timelines. The hazard tables further break down the refueling 
operation into detailed steps and identify hazards associated with each. Potential effects on SSF elements are 
described and severity of impacts are established using the standard NASA hazard categories. These categories range 
from catastrophic to negligible. All potenital hazards, regardless of their probability of occurrence, were considered. 


"Lunar Transfer Vehicle On Orbit Processing Study, Contract NASI 0-1 1400; McDonnell Douglas Space Systems 
Company; December 1990 
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Drop Tankset Propellant Top-off 

Operation Time (hrs / No. Of Shifts) 


Prepare Mini-Depot For Propellant 
Transfer 


Mate Transfer Line Umbilicals 




Four Timelines 
Developed For 
Refueling 
Operations 


Leak Test Conn 


Operation 

Drop Tankset Top-off 

Hazard 

SSF Element 
Affected 

Potential Effect On 
SSF Element 

Crit / 
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Pressure 
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Refueling Hazard Criticality Summary 

The hazards identified in the refueling operation fall under two major categories. The first one involves collision of drop 
tanks during translation and the second category is the propulsive venting/dumping of propellants. Under the first 
category, the hazards identified are propellant slosh and remote manipulator system (RMS) failure resulting in loss or 
degraded control functions. Also included as potential hazards are interface hardware failures such as the grapple 
connection. The second category, propulsive venting/dumping, occurs from either two-phased venting or uncontrolled 
venting due to tank rupture. 

Summary of identified hazards are shown below for the refueling scenario. The majority of the hazards are categorized 
as either catastrophic or critical and therefore require mitigating solutions. 
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Refueling Hazard Criticality Summary 


Major Hazards Identified: 

• Collision During RMS Transport Of Drop Tanks 



- Excessive Slosh, Exceeds RMS Control Capabilities 

- RMS ESectr./Mech. Failure (Loss Of Control) 

- Structural Failure Of Interface Hardware 

• Propulsive Venting/Dumping Of Propellants 

- Emergency Venting Due To Excessive Pressure 
Buildup ( Thermal Control Degradation, Vent 
System Component Failure, Ventline Blockage Due 
To Frozen Propellants) 

• Two Phase ( Liquid/Gas) Propulsive Venting 




Refueling Hazard Criticality Summary (ContJ 
This page left intentionally blank. 
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Refueling Hazard Criticality Summary (Coot. 


- Venting Due To Tank Rupture 

• Uncontrolled Venting May Impart Excessive 
Loads To Truss Element Or Exceed GM&C 

Capabilities 

• Propellant Impingement On Crew And Equipment 


Mitigating Solutions Have 
Been Identified To Eliminate 
Or Lessen The Severity Of 
The Majority Of Catastrophic 
And Critical Hazards 







Preliminary Hazard Mitigating Solutions 

Hazard and safety issues identified will be studied in detail to determine the range of measures which will either 
eliminate or reduce their probability or impact. These measures include hardware design changes, imposing additional 
requirements on the LTV and SSF, procedure modification, and redefining the Lunar mission scenario. For those 
hazards (identified as catastrophic or critical) without effective mitigating solutions, the risk involved with each hazard 
(determined by the probability of occurrence) will be evaluated. The evaluation of mitigating solutions has been initiated 
and some sample solutions are summarized in the chart. Many of the hazards can be addressed by incorporating 
adequate redundancy in key subsystems or components such as multiple vent lines. Other hazards involving those 
resulting from inadvertent collision can be lessened by incorporating measures to reduce damage to key subsystems 
such as the thermal protection system 
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( Pr eliminary Hazard Mitigating Solutions 

• Determine Measures To Either Eliminate Or Reduce 
The Probability Or impact Of Identified Hazards 
Through: 

- Design Changes 

- Additional Requirements 

- Procedure Modifications 

- Different Mission Scenarios 

• Sample Preliminary Solutions: 

- Increased Component Redundancy In SSF And 
LTV Subsystems 

- Multiple Vent Lines - 

- Robust Thermal Protection System On Propellant 
Tank For Lower Susceptability To Damage 



There are ongoing or planned technical development efforts related to cryogenic fluid management that will 
demonstrate or validate technologies and processes to support solutions to the identified hazards. These include the 
ground test programs at NASA Lewis Research Center and Marshall Space Flight Center. These ground test activities 
are demonstrating techniques for low gravity cryogen transfer, active and passive tank pressure control, thermal 
insulation concepts, and advanced instrumentation. Flight experiments are underway or planned which would provide 
low-g validation of the ground test results. 
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Pro P rimary Hazard Mitigating Solutions (Cont.) 



» Technical Development Effort Related To Cryogenic 
Propellants Are Ongoing Or Planned Which Will 
Demonstrate/Validate Mitigating Solutions 


- Cryogenic Ground Test Programs At NASA 
Lewis Research Center And Marshall Space Flight 
Center 

• Cryogenic Storage/T ransfer/Pressure Control 


- Fluid Flight Experiments 

• Low-g Validation Of Ground Tests 




Future Activity 

Subtask 3 and 4 will complete the cryogenic propellant hazard analysis. Subtask 3, identification of hazards, risks and 
safety issues associated with vehicle operation other than refueling, have just been recently completed. Subtask 4, 
identification of mitigating measures to eliminate or reduce risk, will be completed by 9 August 1991. 



Subtask 3 - Vehicle Operations Risk/Hazards 

Evaluation 


- Drop Tankset Docking/Storage 

- Turnaround Operations, Vehicle Sating 

- Orbital Debris/ Micrometeoroid Effects 

- Long Term Thermal Control Degradation 

Subtask 4 - Identification Of Mitigating Solutions 

- Determine Measures To Reduce Or ESiminal 
Risk/Hazard Identified In Subtask 2 And 3 

• Mission Scenario Changes, Operations 
And/Or Design Solutions 
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